EUVD-2025-16875
CVSS Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39938.
Analysis
Local privilege escalation vulnerability in Acronis Cyber Protect 16 (Windows) caused by insecure folder permissions (CWE-732), allowing authenticated local users to escalate privileges with high confidentiality, integrity, and availability impact. The vulnerability affects Windows installations before build 39938, and while the CVSS score of 7.3 indicates significant risk, exploitation requires local access and user interaction. No public indicators confirm active exploitation in the wild or widespread POC availability at this time.
Technical Context
The vulnerability stems from improper access control on application folders (CWE-732: Incorrect Permission Assignment for Critical Resource), a common Windows privilege escalation pattern where overly permissive DACL (Discretionary Access Control List) settings allow non-privileged local users to modify or replace executable files or configuration data used by higher-privileged processes. Acronis Cyber Protect 16 (CPE: cpe:2.3:a:acronis:cyber_protect:16:*:*:*:*:windows:*:*) for Windows installations before build 39938 contains this flaw in its folder permission model. The root cause is likely insufficient restriction on directories containing executable code, libraries, or security-critical configuration files that are executed or loaded with elevated privileges.
Affected Products
- product: Acronis Cyber Protect; version: 16; platform: Windows; affected_builds: Before build 39938; cpe: cpe:2.3:a:acronis:cyber_protect:16:*:*:*:*:windows:*:*; status: Vulnerable - product: Acronis Cyber Protect; version: 16; platform: Windows; affected_builds: Build 39938 and later; cpe: cpe:2.3:a:acronis:cyber_protect:16:*:*:*:*:windows:*:*; status: Patched
Remediation
Update Acronis Cyber Protect 16 (Windows) to build 39938 or later. Check the Acronis security advisory (https://www.acronis.com/en-us/support/security-advisories/) for the specific patch release and deployment instructions.; priority: High Workaround (Interim): Restrict local user access to systems running affected builds; limit multi-user access where possible. Review and restrict folder permissions on Acronis Cyber Protect installation directories using Windows NTFS ACL tools (icacls, Permissions UI) to ensure only SYSTEM and Administrators have write access to application binaries and configuration directories.; priority: Medium Mitigation: Apply principle of least privilege: run Acronis services with minimal required privileges; disable multi-user login on sensitive systems if Acronis is critical infrastructure. Monitor for suspicious file modifications in Acronis installation directories using Windows File Integrity Monitoring (e.g., Autoruns, Event Viewer auditing).; priority: Medium
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today